Unit 1: Windows Operating System Fundamentals and Architecture

I. Orientation — The Windows Operating System

Microsoft Windows is a family of graphical operating systems whose modern desktop line is based on the Windows NT architecture (first released in 1993). An operating system manages hardware resources, provides services to applications, stores files, enforces security, and gives users interfaces for controlling the computer.

• Core purpose: Windows coordinates the CPU, memory, storage, input/output devices, applications, users, and network connections.
• Multitasking: Preemptive scheduling allows several processes and threads to make progress by allocating each one CPU time.
• Multiuser security: User accounts, access tokens, permissions, and User Account Control (UAC) determine which resources a user or process may access.
• Graphical and command interfaces: Windows provides the desktop and File Explorer alongside Command Prompt, PowerShell, and administrative consoles.
• Hardware abstraction: Applications generally access hardware through operating-system APIs and device drivers rather than controlling devices directly.
• Persistent configuration: Files, the Registry, services, policies, and event logs preserve system state and administrative settings.
• Backward compatibility: Windows supports many older Win32 applications while continuing to add newer security and application platforms.

II. Windows Platform — Versions, Interfaces, and Storage

A. Introduction to the Windows operating system

Windows provides the environment in which users, applications, and hardware interact.

• Operating-system role: Windows starts the computer, authenticates users, launches applications, manages resources, and handles errors.
• Application interface: Programs use APIs such as Win32 and .NET libraries to request services including file access, networking, graphics, and memory allocation.
• Security model: Each signed-in user receives an access token containing a security identifier (SID), group memberships, and privileges.
• Startup sequence: UEFI or BIOS loads Windows Boot Manager, which loads the operating-system kernel and essential boot drivers.
• Administrative control: UAC prompts before an unelevated process performs operations requiring administrator rights, such as installing a system-wide driver.
• Client and server families: Windows 10 and 11 target personal computers, while Windows Server editions provide server roles such as Active Directory Domain Services.

B. Windows editions and versions

A Windows version identifies a major release, while an edition defines its intended market and feature set.

• Versions: Examples include Windows 7, 8.1, 10, and 11; each release has its own support lifecycle, build numbers, and hardware requirements.
• Build identification: The winver command displays the installed release, edition, and OS build, such as Windows 11 version 23H2.
• Home edition: Intended for personal use and lacks some business features, including hosting Remote Desktop sessions and joining an Active Directory domain.
• Pro edition: Adds features such as BitLocker management, Group Policy, Hyper-V, domain join, and Remote Desktop hosting.
• Enterprise edition: Provides organization-focused deployment, management, virtualization, and security capabilities through volume licensing.
• Server editions: Windows Server supports infrastructure workloads and may use either Desktop Experience or the reduced-interface Server Core installation.
• Architecture: Current Windows releases primarily use 64-bit x64 processors; Windows 11 is also available for compatible ARM64 systems.

C. User interface and system navigation

The Windows graphical interface organizes applications, files, settings, notifications, and administrative tools.

• Desktop: The main workspace contains windows, shortcuts, files, and the Recycle Bin.
• Start menu: Provides application search, pinned programs, account controls, settings, and power commands.
• Taskbar: Displays running and pinned applications, while the notification area shows background status such as network, volume, and battery.
• File Explorer: Navigates drives, folders, network locations, and libraries; the address bar accepts paths such as C:\Users\Student.
• Settings and Control Panel: Settings is the primary modern configuration interface, while Control Panel retains several legacy administrative applets.
• Window controls: Minimize hides a window, maximize fills the available workspace, and close requests application termination.
• Navigation shortcuts: Win+E opens File Explorer, Alt+Tab changes applications, and Win+I opens Settings.

D. File system hierarchy (NTFS, FAT32)

Windows organizes storage into volumes identified by drive letters and hierarchical paths.

1. NTFS:

   • Capabilities: NTFS supports access control lists, journaling, compression, encryption, disk quotas, hard links, and very large files and volumes.
   • Reliability: Journaling records metadata changes so the file system can recover more consistently after a crash.
   • Permissions: Entries such as Read, Modify, and Full Control can be assigned to users or groups.

2. FAT32:

   • Compatibility: FAT32 is widely supported by operating systems, firmware, cameras, and removable devices.
   • Limitations: A single FAT32 file cannot exceed 4 GiB minus 1 byte, and FAT32 lacks NTFS permissions and journaling.

• Hierarchy: In C:\Users\Asha\report.docx, C: is the volume, Users and Asha are directories, and report.docx is the file.
• Path forms: C:\Windows is an absolute path; Documents\report.docx is relative to the current directory.
• Network paths: A Universal Naming Convention path such as \\Server01\Shared identifies a shared network resource.

E. System folders and environment variables

System folders hold operating-system components, shared application data, user profiles, and temporary files.

• Windows directory: C:\Windows normally contains core resources; %SystemRoot% commonly expands to this location.
• System32: %SystemRoot%\System32 contains 64-bit system libraries, administrative programs, and command-line utilities on 64-bit Windows.
• Program directories: %ProgramFiles% identifies the main application directory, while %ProgramFiles(x86)% normally stores 32-bit applications on x64 Windows.
• User profile: %USERPROFILE% expands to a path such as C:\Users\Asha; Documents, Desktop, and Downloads usually exist beneath it.
• Application data: %APPDATA% points to roaming user data, while %LOCALAPPDATA% stores machine-specific user data.
• Temporary storage: %TEMP% identifies a temporary-file directory whose contents may be removed when no longer required.
• Executable search: %PATH% is a semicolon-separated list of directories searched when a command does not include its full path.

echo %USERPROFILE%
echo %PATH%

III. Windows Architecture and Resource Management

A. Overview of Windows architecture: kernel, services, and drivers

Windows separates ordinary applications from privileged operating-system components to improve control and isolation.

• User mode: Applications and many service processes run with restricted hardware access; a user-mode failure usually does not directly crash the kernel.
• Kernel mode: The NT kernel and executive manage scheduling, virtual memory, input/output, security, objects, and interprocess communication.
• Hardware abstraction layer: The HAL hides hardware-specific interrupt and processor details from higher operating-system layers.
• System calls: User-mode code requests kernel services through controlled transitions rather than directly accessing physical memory or devices.
• Services: Long-running background programs, such as Windows Update, are managed by the Service Control Manager and can start automatically or manually.
• Drivers: Kernel-mode or user-mode drivers translate operating-system requests into device-specific operations for hardware such as storage and network adapters.
• Failure impact: A defective kernel-mode driver may cause a stop error because it executes with extensive privileges.

B. Task Manager and Resource Monitor usage

Task Manager and Resource Monitor expose current workload, performance, and resource-consumption information.

• Opening Task Manager: Press Ctrl+Shift+Esc, or right-click Start and select Task Manager.
• Processes view: Shows applications and background processes with CPU, memory, disk, network, and GPU usage.
• Performance view: Displays utilization graphs and details such as logical processors, committed memory, disk activity, and network throughput.
• Startup apps: Lists programs configured to run at sign-in and estimates their startup impact.
• Details and Services: Details exposes process IDs, priorities, and executable names; Services links processes to Windows services.
• Resource Monitor: resmon.exe provides finer CPU, memory, disk, and network analysis, including file activity, listening ports, and associated handles.
• Diagnostic use: Sustained 100% disk active time paired with a named process can identify an input/output bottleneck.

C. Managing processes, threads, and memory

Windows schedules threads, isolates processes, and uses virtual memory to distribute physical memory efficiently.

• Process: A process is a running program container with a private virtual address space, handles, security context, and at least one thread.
• Thread: A thread is the schedulable execution unit; multiple threads in one process share its code and memory.
• Identification: Windows assigns each process a process ID (PID) and each thread a thread ID (TID).
• Scheduling: The dispatcher selects ready threads according to priority and processor availability, using time slices to support responsiveness.
• Virtual memory: Each process receives virtual addresses mapped to RAM or, when appropriate, backed by the page file.
• Working set: A process working set is the collection of its virtual-memory pages currently resident in physical memory.
• Termination: Ending a process stops all its threads and may lose unsaved data; ending an essential system process can destabilize Windows.
• Priority caution: Raising priority may improve one workload but starve other threads, so it is not a general performance solution.

IV. Persistent Configuration

A. Understanding Windows Registry structure, hives, and keys

The Registry is a hierarchical database containing operating-system, hardware, application, and user configuration.

• Structure: Hives contain keys, subkeys, and named values; values have types such as REG_SZ, REG_DWORD, and REG_BINARY.
• HKEY_LOCAL_MACHINE: HKLM stores computer-wide hardware and software configuration.
• HKEY_CURRENT_USER: HKCU represents settings for the currently signed-in user.
• HKEY_USERS: HKU contains loaded profiles for users and system accounts.
• HKEY_CLASSES_ROOT: HKCR presents merged file-association and COM registration information derived mainly from machine and user software settings.
• HKEY_CURRENT_CONFIG: HKCC exposes information about the current hardware profile.
• Management tools: regedit.exe, reg.exe, and PowerShell Registry providers can inspect or modify entries.
• Risk control: Incorrect edits may prevent applications or Windows from functioning; export relevant keys and use documented management tools before changing values.

V. Administrative and Diagnostic Tools

A. Introduction to command-line tools (CMD, PowerShell)

CMD and PowerShell both automate administration, but they use different command and data models.

1. Command Prompt:

   • Model: cmd.exe runs traditional commands and batch files, generally passing plain text between utilities.
   • Examples: dir, copy, ipconfig, and tasklist provide file, network, and process operations.

2. PowerShell:

   • Model: PowerShell cmdlets use a Verb-Noun naming pattern and pass structured .NET objects through pipelines.
   • Examples: Get-Process, Get-Service, and Stop-Process expose properties that can be filtered or sorted.

Get-Process |
    Sort-Object CPU -Descending |
    Select-Object -First 5 Name, Id, CPU

• Privilege level: Commands that alter protected system settings must run in an elevated terminal approved through UAC.

B. System information commands

System information commands provide concrete evidence about software, hardware, networking, storage, and running components.

• General configuration: systeminfo reports the OS edition, build, installation date, system model, memory, and installed hotfixes.
• Version check: winver opens the Windows version dialog, while ver prints a concise CMD version string.
• Network configuration: ipconfig /all displays adapters, MAC addresses, IP addresses, gateways, DNS servers, and DHCP details.
• Process inspection: tasklist lists running processes and PIDs; Get-Process provides richer PowerShell objects.
• Storage inspection: Get-Volume displays drive letters, file systems, health status, capacity, and remaining space.
• Hardware and OS objects: Get-ComputerInfo gathers extensive Windows, firmware, processor, and system information.
• Driver listing: driverquery reports installed drivers, their types, and current states.

C. System logs via Event Viewer

Event Viewer presents timestamped records generated by Windows components, services, drivers, security auditing, and applications.

• Opening the console: Run eventvwr.msc or search for Event Viewer.
• Application log: Contains events written by applications, including crashes and application-specific warnings.
• System log: Records events from drivers and Windows services, such as startup failures or storage errors.
• Security log: Stores audited activity such as logons and policy changes when the corresponding audit policies are enabled.
• Setup log: Records events associated with installation and configuration activities.
• Event fields: Each record includes a date and time, source, event ID, level, user where applicable, and descriptive details.
• Levels: Information records normal activity; Warning signals a possible issue; Error indicates a failure; Critical marks a severe condition.
• Filtering: Filter Current Log can restrict results by time, level, source, event ID, or keyword.
• Correlation: A reliable diagnosis compares timestamps, event IDs, affected components, and repeated patterns rather than treating one event as conclusive.